malwarewikiaorg-20200223-history
SpySheriff
SpySheriff is rogue software that pretends to be antivirus software when it is actually a piece of severe malware itself. It provides exaggerated and false details on so called malware in the computer. As a way of so called "protection" it locks Internet Explorer to prevent so called "severe malware" infecting and also locks System Restore to prevent the compromised computer from using normal procedures to protect itself. It also corrupts the system so that when supposedly removed from the computer, the computer crashes. Even if it is removed, it manages to restore itself."Spyware tunnels in on Winamp flaw" by Joris Evers, CNET News.com, February 6, 2006 "Top 10 rogue anti-spyware" by Suze Turner, ZDNet, December 19, 2005 Websites promoting SpySheriff The typo squatted version of Google.com/.ca (Goggle.com/.ca) are always redirected to SpySheriff's Website and download the malware to the computer without consent. Toggle.com (the typo squatted version of toogle.com) is another well known infected site. Problems caused by SpySheriff *SpySheriff cannot be simply deleted, as it reinstalls itself through hidden components on the computer. Trying to remove it with the Add/Remove programs feature has similar results, or may result in a system crash. A blue screen of death may occur. *The program will stop the computer from connecting to the internet or a limited internet connection, and will display an error message reading "The system has been stopped to protect you from Spyware." *The desktop background can also be replaced with a blue screen of death, or a notice reading: "SPYWARE INFECTION! Your system is infected with spyware. Windows recommends that you use a spyware removal tool to prevent loss of data. Using this PC before having it cleaned of spyware threats is highly discouraged." *SpySheriff has been known to create one or more administrator accounts, to block access to programs and utilities for other users. If logged in as an administrator, it is sometimes possible to delete the SpySheriff account(s). *It also acts to stop any attempt to do a System restore by preventing the calendar and restore points from loading. This prevents the user from being able to revert their computer to an earlier usable state. A System restore is however often possible after booting in Safe mode. *It blocks several websites, including the ones that have downloadable anti-spyware software, locks the user's Internet Explorer options, and it has also been implemented in pirated versions of Norton AntiVirus. *It will likely create the need for the use of a recovery disk to restore original factory specs. SpySheriff clones The company that developed SpySheriff, knowing that people have become aware of SpySheriff being malware, has created several SpySheriff clones that have different names and styles than SpySheriff, but share the same interface and similar behaviors of SpySheriff. Adware Sheriff, Pest Trap, SpywareNo, Spylocked, SpywareQuake, SpyTrooper, Spydawn, AntiVirGear, Brave Sentry, System Security, SpywareStrike, SpyShredder, Alpha Cleaner, SpyBot SpyMarshal, and SpyAxe are the best known of these. Removal SpySheriff is difficult to remove manually. Attempting to remove it using the "Add/Remove Programs" control panel may sometimes work, but it is highly unlikely; SpySheriff has a tendency to reinstall itself due to hidden components in files on your computer. The simplest solution is to try genuine spyware removal tools in the hopes that it can be cleaned, but there are also possibilities for manual removal. Since System Restore is locked by SpySheriff, it is very hard to remove it through it; however, using System Restore in Safe Mode might work, but there is a possible chance that the SpySheriff's components may be inside the System Restore folders. Tools called SmitFraudFix and SmitRem are said to get rid of SpySheriff; they work by deleting all of SpySheriff's components and if the desktop wallpaper had been changed, the removal tool replaces it with a plain blue screen (by setting the desktop settings to None). Ad-Aware and Vundo-Fix can remove SpySheriff components by removing trojans associated with the program. HijackThis is sometimes recommended to remove registry entries by SpySheriff. Sometimes the only way to completely remove the virus is by saving all documents on a hard drive and re-installing Windows/reformatting if the above removal solutions do not seem to work. Using antivirus and/or anti-spyware software can prevent this infection from entering the computer. See also *Rogue software *Trojan horse References External links *http://www.bleepingcomputer.com/forums/topic22402.html Category:Rogue software